I recently acquired root access to an Apple Airport Express router (2nd gen), and I would like to dump the current bootloader of the device to a .bin file I suppose. What tools would be necessary for doing such a thing? I am open to all suggestions short of desoldering the flash chip from the device.
Okay, one of the lowest level approaches would be to desolder the flash and then read it with a device suitable for that particular chip.
However, if you have a JTAG (jtag) probe, find the JTAG header and find out as much as possible about the chips (otherwise you can literally fry the hardware). Then use the JTAG probe and an openly available tool such as OpenOCD to dump the contents of the flash chip. This should also be usable to flash it again.
However, since this is very specific to each piece of hardware it's hardly possible to give some generic advice about how to go about and what to be careful about.
Refer to the above linked question for details on how to find the JTAG header after disassembling the device and look in the jtag tag to find other existing questions and answers surrounding that topic.